Skip to main content
cve.nowby Sazabi
← npm
npmPackage

express

5 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 4 medium
Registry
npm

Advisories 5

  • CVE-2024-10491Medium 4.0

    Preload arbitrary resources by injecting additional `Link` headers

    Affected: from 3.0.0-alpha1, through 3.21.2; fixed in 4.0.0-rc1.

  • CVE-2024-9266Medium 4.7

    Open Redirect

    Affected: from 3.4.5, fixed in 4.0.0-rc1.

  • CVE-2024-43796Medium 5.0

    express vulnerable to XSS via response.redirect()

    Affected: fixed in 4.20.0; from 5.0.0-alpha.1, fixed in 5.0.0.

  • CVE-2024-29041Medium 6.1

    Express.js Open Redirect in malformed URLs

    Affected: fixed in 4.19.2; from 5.0.0-alpha.1, fixed in 5.0.0-beta.3.

  • The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400…

    Affected: fixed in 3.11.0; from 4.0.0, fixed in 4.5.0.